[dependabot]

Bumps jdx/mise-action from 5.1.1 to 5.2.0.

Release notes

Sourced from jdx/mise-action's releases.

v5.2.0: Periodic cache rebuilds, signed packslip verification, and monorepo installs

The default cache key now rolls over every 30 days, so long-lived caches pick up newer mise releases. The action also checks the downloaded mise binary against the release's signed packslip, and it runs mise install --monorepo automatically in monorepos. Existing caches miss once after you upgrade, because the default cache key format has changed.

Added

• The cache is rebuilt every 30 days by default. GitHub never evicts a cache that keeps getting hits. Before this release, an active repo could keep the same mise binary and tools for months, until a config file changed. The default cache key now includes a period suffix (-p<N>), so the cache is rebuilt from scratch at least once per period. All repos roll over on the same calendar boundary. Use the new cache_max_age_days input to change the period, or set it to 0 to keep the old key that never expires. Custom cache_key templates can use the new {{cache_period}} variable, which {{default}} already includes. A custom key that doesn't use it behaves as before. On self-hosted runners that keep mise data between runs, you may also need auto_update: true to pick up a newer mise. (#689 by @​jdx, fixes #688)

  - uses: jdx/mise-action@v5
    with:
      cache_max_age_days: 14 # default 30; 0 disables periodic rebuilds

• Throttled cache restores and saves can be retried. Before this release, when GitHub's cache service returned HTTP 429, the action gave up right away: a restore counted as a miss and a save was skipped. The new cache_restore_retry_budget and cache_save_retry_budget inputs set how long the action may wait. Each retry waits for the Retry-After value plus some random jitter. Once the budget runs out, the action falls back to the old behavior. Retries apply to the main cache, the post-step save and the binary cache. Real cache misses and reservation conflicts are never retried. Both budgets default to 0s (no retries). @actions/cache doesn't report 429 errors directly, so the action detects throttling from its warning messages. If those messages change in a future @actions/cache release, throttling won't be detected and nothing will be retried. (#692 by @​jdx, fixes #691)

  - uses: jdx/mise-action@v5
    with:
      cache_restore_retry_budget: 60s
      cache_save_retry_budget: 120s

• The latest mise binary can fall back to a second download source. When the action downloads the latest mise version, it can fall back between GitHub and mise.jdx.dev if the first source fails. The fetch_from_github setting decides which source it tries first. Pinned versions and minimum_release_age installs are only downloaded from GitHub. The binary is still checked against the signed checksums for the resolved version, whichever source it came from. (#692 by @​jdx)
• The mise binary is checked against its signed packslip. If a mise release includes packslip.sigstore.json, the action checks the downloaded binary against it. The bundle must be signed by mise's release workflow for that exact tag. After a successful check, the log shows Verified <asset> against the signed packslip. If the check fails, the install stops instead of falling back to a weaker check. Releases without a packslip use the existing minisign and SHASUMS256 check. An explicit sha256 input still takes precedence. (#693 by @​jdx)
• Monorepo-aware installs. If your mise config sets [monorepo].config_roots, the action now adds --monorepo to mise install, so tools configured anywhere in the monorepo get installed. Repos without that setting aren't affected. To opt out, set monorepo: false. (#679 by @​zeitlinger)

Fixed

• Tool directories that mise moves to the front of PATH are now exported. The action used to find mise's PATH changes by comparing mise's PATH with the runner's. If a tool's bin directory was already on the runner's PATH, such as ~/.cargo/bin, mise only moved it to the front, so the action didn't export it. Later steps then found the mise shim first. For example, rustup resolved to the shim instead of ~/.cargo/bin/rustup. The action now asks mise for its entries with mise env --paths and exports them in the order mise reports. This fix needs a mise version that supports --paths. With older versions, the action uses the old comparison. (#685 by @​jdx)

Documentation

• The new "Release workflows" section of the README says that jobs that publish releases shouldn't restore caches. A lower-trust workflow that can write to default-branch caches could otherwise slip files into a release. In those jobs, use cache: false or GitHub's cache-mode: none. (#682 by @​jdx)
• The README explains how to cache mise's downloads, keyed on mise.lock, instead of installed tools. It includes a Windows example that sets MISE_CACHE_DIR from ${{ runner.temp }}, because actions/cache doesn't expand %TEMP%. (#686, #690 by @​zeitlinger)

Breaking Changes

• The default cache key has a new format, so the first run after upgrading is a cache miss and saves a fresh cache. After that, the cache is rebuilt every 30 days by default. To keep the old cache key that never expires, set cache_max_age_days: 0. Workflows that set a custom cache_key without {{default}} or {{cache_period}} aren't affected.

Full Changelog: jdx/mise-action@v5.1.2...v5.2.0

v5.1.2: mise_dir now sets MISE_DATA_DIR; auto_update handles a locked mise binary

The mise_dir input now also sets where mise installs tools, so those tools end up in the cache. With auto_update: true, the action no longer crashes on Windows when the mise binary is still in use.

Fixed

• mise_dir now exports MISE_DATA_DIR. Before this release, mise_dir moved the mise binary and the cache path, but mise kept installing tools to ~/.local/share/mise. The saved cache didn't include the tools. On runners where ~/.local isn't writable, the step failed with EACCES: permission denied. When mise_dir is set, the action now exports MISE_DATA_DIR=<mise_dir>, so tools are installed into the directory that gets cached. If your workflow sets a different MISE_DATA_DIR, the mise_dir input overrides it. If mise_dir isn't set, nothing changes. mise's state directory (~/.local/state/mise) stays where it is. If that path also can't be written, set MISE_STATE_DIR yourself. (#672 by @​jdx, fixes #668)

  - uses: jdx/mise-action@v5
    with:
      mise_dir: ${{ runner.tool_cache }}/mise/data

• auto_update no longer crashes when it can't replace mise.exe. On Windows, the step used to fail with a bare EPERM: operation not permitted, unlink '…\mise.exe' if another process was still using the binary. Now, if version isn't pinned and the existing binary passes verification against its recorded version, the action prints a warning and continues with that version. In any other case, the step fails with a message that says the file is in use and how to fix it. A pinned version never quietly keeps an older binary. (#665 by @​jdx, fixes #664)

... (truncated)

Changelog

Sourced from jdx/mise-action's changelog.

Changelog

---

5.2.2 - 2026-10-21

🐛 Bug Fixes

• hash conf.d config fragments in cache key (#698) by @​rileymichael in #698

New Contributors

• @​rileymichael made their first contribution in #698

---

5.2.1 - 2026-10-19

🐛 Bug Fixes

• require the signed packslip for mise 2026.9.3 and later (#695) by @​jdx in #695

---

5.2.0 - 2026-10-16

🚀 Features

• (cache) rebuild the cache every 30 days by default (#689) by @​jdx in #689
• (cache) retry throttled cache restores and saves (#692) by @​jdx in #692
• verify the mise binary against its signed packslip (#693) by @​jdx in #693

🐛 Bug Fixes

• export the PATH entries mise reports with mise env --paths (#685) by @​jdx in #685

🔍 Other Changes

• Use monorepo install when configured (#679) by @​zeitlinger in #679
• Change minimum age for auto-merging release PRs by @​jdx in b511e8d

📚 Documentation

• tell release workflows not to use the cache (#682) by @​jdx in #682
• explain caching mise downloads instead of installs (#686) by @​zeitlinger in #686
• use resolved Windows downloads cache path (#690) by @​zeitlinger in #690

⚙️ Miscellaneous Tasks

• stop restoring caches in release jobs (#683) by @​jdx in #683
• replace prettier with oxfmt (#694) by @​jdx in #694

---

... (truncated)

Commits

• 9b200bc chore: release v5.2.0 (#680)
• b511e8d Change minimum age for auto-merging release PRs
• 887d1f4 docs: use resolved Windows downloads cache path (#690)
• 93c62ad chore: replace prettier with oxfmt (#694)
• 04716d4 feat: verify the mise binary against its signed packslip (#693)
• 5108104 feat(cache): retry throttled cache restores and saves (#692)
• d401260 docs: explain caching mise downloads instead of installs (#686)
• e7cf35f feat(cache): rebuild the cache every 30 days by default (#689)
• cd02696 fix: export the PATH entries mise reports with mise env --paths (#685)
• 6784481 docs: tell release workflows not to use the cache (#682)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[qawatake]

Update review: jdx/mise-action 5.1.1 → 5.2.0

Reviewed head: eb9ce4138f8924d5c3750c6021766ebb32181625 (base ead3a5b452eff22dbf8588833336a14c9caaf25e)

Final verdict: Proceed
Risk: Medium — axes hit: change type (minor release with a documented default change: the cache key format). The other axes are low: CI-only tool, no external input, rollback is reverting the pin, the changed behaviour is exercised by this PR's own CI run, supply chain checks pass, license unchanged.
Review type: Approve
Release/deploy: Not needed (no-release) — reason: this repository is a sample / reference setup for Obsidian plugin e2e testing and ships no artifact: there are no GitHub releases or tags, main.js is gitignored ("They should be uploaded to GitHub releases instead" but no release workflow exists), and nothing is published to npm. The only thing readers consume is the repository content itself, which this merge updates directly. The change is workflow-only (.github/workflows/ci.yml), so there is nothing to build and compare. I add no-release so the PR does not read as "undecided".

Changes reviewed (2.1)

• Primary sources read: release notes for v5.1.2 and v5.2.0, CHANGELOG.md, compare v5.1.1...v5.2.0 (29 commits), the action.yml diff and the dist/package.json diff.
• Version range covered: 5.1.1 → 5.1.2 → 5.2.0.
• Breaking / behavior changes: (1) the default cache key gains a 30-day period suffix -p<N> and a new input cache_max_age_days (#689): one cache miss after the upgrade, then a rebuild every 30 days. (2) New input monorepo (default true): adds mise install --monorepo only when the mise config has [monorepo].config_roots (#679). (3) PATH export now follows mise env --paths order (#685). (4) The mise binary is verified against the release's signed packslip via sigstore; no fallback on verification failure (#693). (5) Latest-version lookup falls back from GitHub to mise.jdx.dev (#692). (6) v5.1.2: mise_dir now exports MISE_DATA_DIR; Windows auto_update no longer crashes on EPERM. Inputs were only added, none removed or renamed; runtime stays node24; no new permissions. dist/index.js grows by ~47k lines because the new runtime dependency packslip@1.8.0 (same owner, jdx) and sigstore are bundled.

Impact and adequacy of the PR (2.2, 2.3)

Change	Affected location / none	Evidence	PR handling adequate?
Cache key format	All 3 jdx/mise-action steps in ci.yml (build, e2e, test-e2e-tools) use cache: true without cache_key	grep cache_key in .github/workflows: no hits	Yes. Seen in this head's CI: mise cache not found for mise-v1-linux-x64-ubuntu24-2026.8.3-p691-… / …macos-arm64-macos26-…-p691-…, then the cache is saved. One-off miss, nothing to configure
mise version drift through the cache rebuild	None	Every step pins version: 2026.8.3; check-toolchain.mjs → toolchain: ok (pnpm 10.33.2, node 24)	Yes
monorepo	None	grep [monorepo] / config_roots in mise.toml: no hits	Yes
PATH export order	mise-managed tools are node 24 and pnpm only	No rustup / cargo or other preinstalled-tool overlap (grep in workflows: none)	Yes
packslip (sigstore) verification	The mise download in every job	Log on ubuntu and macOS: Verified mise-v2026.8.3-linux-x64.tar.zst against signed checksums / …macos-arm64…	Yes
Fallback to mise.jdx.dev	None: a pinned version fetches from GitHub only; hosted runners without an egress allowlist	—	Yes
mise_dir / MISE_DATA_DIR	None	grep `mise_dir	MISE_DATA_DIR` in workflows: no hits
SHA pin	9b200bcecbfd6303e69a4a261b2e09e3757440a7 is the commit of the lightweight tag v5.2.0; the # v5.2.0 comment matches in all 3 places	tag dereference; CI check-actions-pinned.mjs passed	Yes

Verification (2.4)

• CI on this head (https://github.com/qawatake/obsidian-e2e-sample/actions/runs/40000584521): build passed (frozen install, toolchain / actions-pinned / config-schema checks, pnpm audit "No known vulnerabilities found", lint, typecheck, build, bundled-deps check), e2e passed on macOS (e2e:setup "1 passed", e2e:test "1 passed"), test-e2e-tools passed (e2e:setup and e2e:cleanup, "1 passed" each). I read the logs: mise-action v5.2.0 ran in all three jobs with the behaviours listed above (cache miss on the new -p691 key, packslip verification).
• Base moved since this CI ran: main is now eea83f1 (#57). git log ead3a5b..origin/main --stat shows exactly one commit touching mise.toml and package.json (pnpm 10.33.2 → 10.34.7, 2 insertions / 2 deletions), no workflow file. GitHub reports the merge state as CLEAN, so the review was done against this head as-is.
• main's own ci run on eea83f1 (https://github.com/qawatake/obsidian-e2e-sample/actions/runs/40065247461) fails at pnpm audit --audit-level=high with two advisories published on 2026-10-23 after this PR's CI: GHSA-jr5w-w6x2-84p9 (electron < 43.8.1) and GHSA-xjj6-f33q-929c (undici < 7.30.1, via electron > @electron/get). That failure is pre-existing and independent of this PR; the post-merge ci run will show it too until the lockfile PRs (#56 / #58) land.

Rollback, supply chain, license (2.5, 2.6, 2.7)

• Rollback: revert the pin. No persistent side effect beyond an extra cache entry.
• Supply chain: tag v5.2.0 → commit 9b200bce, a GPG-verified chore: release v5.2.0 (#680) by jdx (owner), contained in main. Release created by github-actions[bot] through the same release workflow as v5.1.1. Published 2026-10-16 (8 days ago). No maintainer change. The new runtime dependency packslip@1.8.0 is published by jdx's own npm account with provenance. Binary verification is strengthened (sigstore identity jdx/mise release.yml). Known gap: v5.2.0 silently falls back to minisign verification when the packslip is missing (closed in v5.2.1); minisign verification is what v5.1.1 did, so this is not a regression.
• License: MIT → MIT (LICENSE blob identical). Newly bundled transitive packages are MIT / ISC / Apache-2.0 / BSD-2-Clause / BlueOak-1.0.0, all permissive.

Blocking conditions

• Hit: none.

Requests

• None for the PR author. This PR touches only ci.yml; #56 and #58 touch only package.json / pnpm-lock.yaml, so there is no file overlap in this repository.

Unverified / notes for other reviewers (2.9)

• Reproducibility of dist/index.js from src/ was not verified.
• The sigstore verification path was observed only as the log line; the TUF root fetch was not inspected.
• v5.2.1 / v5.2.2 exist (v5.2.1 closes the fallback gap above). Dependabot's 7-day cooldown will offer them later.